The 'hacker tool' worm that gurned

The old English practice of gurning, in which participants pull a funny or scary face, is being used by a newly discovered worm to distract PC users while their machines are being compromised.

The Wurmark-F worm, a variant of Wurmark-D which began spreading last month, arrives as a zipped email attachment and displays a picture of an old man pulling an impressive gurn.

Meanwhile the worm installs itself in the Windows system folder, along with a new version of the Rbot worm, which spreads via networks without the need for user interaction.

Wurmark-F then harvests email addresses, except those of antivirus companies, and emails itself out. The Rbot payload immediately starts to look for vulnerable computers on the network and installs a Trojan to allow the PC to be used remotely for hacking or spamming.